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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 
All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
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NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . This communication is responsive to amendment filed on 3/21/2005 . 

2. £3 The allowed claim(s) is/are 1.3-14.16-31 and 33-41 . 

3. ^ The drawings filed on 16 January 2002 are accepted by the Examiner. 

4. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b) □ Some* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

5. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 
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(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 
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Paper No./Mail Date . 
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DETAILED ACTION 
Allowable Subject Matter 

1. Claims 1, 3-14, 16-31 and 33-41 are allowed. 

2. The following is an examiner's statement of reasons for allowance: 

2.1 Referring to the independent claims 1, 14, 18, 22, 26, 31, Trcka discloses a 
network security and surveillance system (see abstract and Fig. 3). Trcka teaches that 
a network security and surveillance system passively monitors and records the traffic 
present on a local area network, wide area network, or other type of computer network, 
without interrupting or otherwise interfering with the flow of the traffic. Raw data packets 
present on the network are continuously routed (with optional packet encryption) to a 
high-capacity data recorder to generate low-level recordings for archival purposes. The 
raw data packets are also optionally routed to one or more cyclic data recorders to 
generate temporary records that are used to automatically monitor the traffic in near- 
real-time. A set of analysis applications and other software routines allows authorized 
users to interactively analyze the low-level traffic recordings to evaluate network 
attacks, internal and external security breaches, network problems, and other types of 
network events (see abstract and Fig. 3). 

2.2 Trcka, however, does not teach or suggest "receiving raw computer events with a 
fusion engine", which can correlate and classify raw computer events in real time as 
stated in specification (page 6, lines 3-15). 

Trcka does not teach or suggest "classifying the raw computer events with the fusion 
engine". Trcka also does not teach or suggest identifying relationships between raw 
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computer events with the fusion engine in order to determine if the raw computer events 
are a part of a larger computer attack. 

2.3 Further more, with regard to claims 1 , 14, 31, Trcka does not teach generating a 
mature correlation event message. Mikurak, teaches that after the events are 
correlated, a fault message is created in a fault message step 4508 (see Fig. 4). 
However, the combination of teachings of Trcka and Mikurak does not provide any 
teachings of receiving the raw events with the fusion engine and than generating the 
mature correlation event message based on the identification of the relationship 
between the events by the fusion engine. 

3. In view of Applicant's amendments and reasons presented herein claims 1 , 3-14, 
16-31 and 33-41 are in condition for allowance. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Grigory Gurshman whose telephone number is 
(571 )272-3803. The examiner can normally be reached on 9 AM-5:30 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571)272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free). 
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